1

I work for a Social Welfare Center in Greece, that consists of 5 separate institutions, located on a radius of roughly 150 km. 4 of those are effectively connected through Syzefxis which is a national project for various telecommunications, including a 255.255.255.0 subnet for each institution. That said, we were able to allow LAN access in-between 4 institutions easily, which has really improved data centralization, etc.

To clarify my position, I am a PHP developer, with a small background in software development and a relatively small experience in networking and administration. Being the only tech-related employee, I am practically administrating the whole network, also repairing all PCs (including really old ones), developing our website and doing anything related to not-only electronic devices, in general. (At this point, you should already feel some compassion for me... Honestly, they ask me to fix everything from a network switch, to an air-conditioner remote controller, to perforators, etc).

At this point, the problem for our network is clear. One of our institutions is in desperate need of access to our LAN. We currently have two options:
A) Either set up our own VPN -or-
B) Ask our ISP (SYZEFXIS) to provide a remote-connection point (as they call it), which is practically the same thing, but we will pay a monthly fee for it.

I would be glad to hear any other option you might suggest, as this is our real problem.

I have taken the liberty to try and setup our own VPN on our institution server, which is also our web server, our file server, our proxy server and the only machine with two pshysical IPs. The IP that is used by all those services is 10.169.31.29. So, I installed the "Network Policy and Access Services" Server Role, without RADIUS and set it to its other IP, which is not occupied by other roles: 10.169.31.31.

Although, here are some restrictions that have made it very hard for me to continue:
1) I cannot do my own port-forwarding. I can only ask our ISP to open some ports, which requires days wasted by bureaucracy, so I cannot test my vpn from outside the LAN.
2) Our server OS is Windows Server 2008 R2, and the client machines are Windows XP (probably Home editions). And unfortunately, I cannot change that.
3) Once I get the client machines connected to the first subnet, I would need to somehow grant access to all 4 subnets (which means access to 255.255.0.0).
4) Our LAN has no DHCP. All IPs within SYZEFXIS must be manually set.

Questions:
1) Can I test the VPN from another subnet within the LAN? I have tried to do so, but I get various errors, for which I am unsure whether they relate to the fact that I am trying to connect to a LAN that I am already part of, or to the existing configuration.
Some of these errors are:

  • Error 800: Unable to Establish Connection
  • Error 13806
  • Error 913

2) Based on the fact that this server is already playing many roles, would it be preferable to avoid setting up a VPN on it and just go with the paid solution by our ISP?

3) Despite being highly unlikely, if I ever get this VPN up and running, will it automatically allow clients to access all 4 subnets, or should I somehow configure that?

I have already tried finding solutions to the errors online, but I can't seem to get anything straight in my head. Please excuse the length of my question and thank you for your time reading so far.

  • Also, keep in mind that you will likely have a host of (security) problems soon with Windows XP end of life. – MichelZ May 22 '14 at 7:26
  • Yes - I'm aware of that. I would really like to throw them all in the sea (about 20 or more machines), but most of our network consists of XP. – mavrosxristoforos May 22 '14 at 7:33
  • 1
    Then do it and upgrade. – MichelZ May 22 '14 at 7:34
  • I wish I could. We're talking about 20+ machines with most of their HD GBs laying on their desktops, and usually around 2 GB of Internet Explorer (8 or earlier) temporary files, with owners so attached to them that would probably fall in the sea behind them, to rescue them :) – mavrosxristoforos May 22 '14 at 7:38
  • That's not an excuse for not upgrading them... anyways, good luck :) – MichelZ May 22 '14 at 7:47
1

From your first question it looks like you are using Microsofts PPTP. If so, stop right there. PPTP has been known to be unsafe for years. You should use something more secure like OpenVPN.

1) Can I test the VPN from another subnet within the LAN?

This should be no problem, as long as the server permits access from that subnet.

2) Based on the fact that this server is already playing many roles, would it be preferable to avoid setting up a VPN on it and just go with the paid solution by our ISP?

Why not set up a small VPN? Most VPN Software can handle very small installations - I just recently set up a VPN on a RaspberryPi. A VPN this is very cheap and you have full control and no bureaucracy that holds you back.

3) Despite being highly unlikely, if I ever get this VPN up and running, will it automatically allow clients to access all 4 subnets, or should I somehow configure that?

You need to configure that. Most VPN Software only pushes the route to it's own private network(at most). Don't forget, that this means, that the VPN Server needs access to all private networks.

  • I had no idea that the Microsoft approach to VPN was insecure. Thanks about that. Do you think that I could be able to set up OpenVPN on that server, or is it resource hungry? – mavrosxristoforos May 22 '14 at 7:31
  • You could probably do that, but I would strongly advise against it. Having too many services on one machine can easily become a security problem, as you have more and more services where an attacker could probably get in.. – Izzy May 22 '14 at 9:08
  • Thanks MKzero. I will allow some time to see if other suggestions pop up, and accept your answer otherwise. – mavrosxristoforos May 22 '14 at 9:10
0

Can I test the VPN from another subnet within the LAN?

Yes, definitely. all depends on the solution and settings you use, but it's no different than using an "outside" VPN

Based on the fact that this server is already playing many roles, would it be preferable to avoid setting up a VPN on it and just go with the paid solution by our ISP?

Yes, definitely use another machine or a paid solution.

Despite being highly unlikely, if I ever get this VPN up and running, will it automatically allow clients to access all 4 subnets, or should I somehow configure that?

You need to configure that. All clients needs routes to the other subnets going through the VPN Server.

  • Thank you for your answer. Would you please add some more information/guidance on points 1 and 3? – mavrosxristoforos May 22 '14 at 7:19
  • 1
    Unfortunately not. We do not do tutorials on serverfault. Google should be full of guides, have a look here as a starting point. – MichelZ May 22 '14 at 7:24
  • That's ok. I appreciate your answer. – mavrosxristoforos May 22 '14 at 7:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.